GCFA Practice Test 3 — 25 Questions

Question 1

An analyst is examining an NTFS volume and finds that a file's $DATA attribute is resident. The file size is 800 bytes. The analyst attempts to recover the file content using a tool that only reads the data runs from the MFT record. What will be the outcome of this recovery attempt?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The tool will fail to recover the file content because it does not parse the resident data within the MFT record.. Resident $DATA attributes store file content directly within the MFT record, not in separate clusters. A tool that only reads data runs is designed for non-resident attributes and will not extract resident data. Therefore, the recovery attempt will fail because the tool does not parse the resident data. The content remains in the MFT record but is inaccessible to this tool.

Answer

The tool will recover only the first 800 bytes from the data runs, which are partially resident.

Answer

The tool will successfully recover the file content because the data is stored in the MFT record.

Answer

The tool will recover the file content from the $ATTRIBUTE_LIST if the resident data overflows the MFT record.

Question 2

An analyst is creating a timeline from a forensic image of a Windows 7 system using The Sleuth Kit's fls and mactime tools. The analyst notices that the timeline includes entries for files that no longer exist on the volume. Which NTFS artifact is most likely responsible for these entries, and how should the analyst interpret them?

Accepted Answer

The $MFT contains entries for deleted files that have not been overwritten, and these entries represent files that once existed and may still be recoverable.. The correct answer is the option describing the $MFT. NTFS keeps MFT records for deleted files in an unallocated state until they are reused. The Sleuth Kit's fls tool reads these records and includes them in the bodyfile, causing deleted files to appear in the timeline. Investigators should interpret such entries as evidence of past file existence and potential recoverable data. The $MFT is a primary source for file system timeline reconstruction, especially for files that have been deleted but not overwritten.

Answer

The $LogFile contains records of file system transactions, and it retains entries for files that were deleted, which the tool interprets as current files.

Answer

The $UsnJrnl records all changes to files, including deletions, and it retains the file names and timestamps for deleted files indefinitely.

Answer

The $Bitmap tracks cluster allocation, and it includes entries for files that were deleted but whose clusters have not been reallocated.

Question 3

During a post-incident review, a team realizes they missed a critical indicator of compromise (IOC) because they did not normalize their log data. What is the primary benefit of log normalization in an enterprise incident response environment?

Accepted Answer

It enables cross-platform correlation by providing a consistent event schema.. Log normalization transforms heterogeneous data from various vendors, formats, and sources into a standardized schema. This allows security tools to correlate events across the environment, such as matching a Windows Security log event to a Cisco firewall connection. Without normalization, analysts spend significant time manually parsing logs, which delays detection and increases the likelihood of missing subtle, multi-stage attack patterns that occur across disparate systems during an enterprise-wide security breach.

Answer

It removes sensitive PII from logs to ensure regulatory compliance.

Answer

It compresses log files, reducing storage costs for long-term retention.

Answer

It automatically blocks malicious traffic detected within the log streams.

Question 4

A forensic analyst is creating a timeline from an NTFS volume and wants to include the $MFT's record number 0, which contains metadata about the MFT itself. What is the primary purpose of including this record in the timeline?

Accepted Answer

It contains the $MFT's own metadata timestamps, which can indicate when the MFT was last modified or extended, useful for detecting file system changes.. MFT record 0 is the $MFT's own file record, and its timestamps track changes to the MFT structure itself. Including it in a timeline helps analysts identify when the MFT was modified, which can correlate with mass file operations or anti-forensic activity. It does not provide volume creation, deleted file lists, or mount times.

Answer

It stores the list of all deleted files, which can be used to recover evidence of file deletion.

Answer

It provides the creation timestamp of the volume, which is essential for establishing the system's install date.

Answer

It records the last time the volume was mounted, which is critical for correlating with external device connection times.

Question 5

A large enterprise is responding to a ransomware incident. The adversary has deployed malware that encrypts files and deletes volume shadow copies. The incident response team needs to determine the initial infection vector and the scope of the compromise. They have collected logs from various sources. Which of the following log sources is MOST likely to contain evidence of the initial infection vector if the adversary used a phishing email with a malicious attachment?

Accepted Answer

Email gateway logs. Email gateway logs are specifically designed to record email metadata and content, including attachments. In a phishing incident, these logs provide the earliest evidence of the attack, showing the malicious email's delivery, sender, and attachment details. This allows responders to identify the initial vector, block similar emails, and notify other potential victims. Other log sources may show subsequent activity but lack the email context.

Answer

Windows Security event logs on the domain controller

Answer

Sysmon logs on user workstations

Answer

Firewall logs

Question 6

An investigator is adding NTFS USN change journal records to a file system timeline on a Windows 10 workstation. The journal was captured live with fsutil usn readjournal and shows a record with Reason value 0x00000100 (DATA_OVERWRITE) for a user document. The investigator wants to determine whether the file content was actually altered at that moment. Which statement best describes what the USN record establishes?

Accepted Answer

The record proves the file's data stream was overwritten at the time of the USN entry and can anchor the timeline for content modification.. USN journal records capture specific change reasons at the moment they occur, and DATA_OVERWRITE specifically denotes that file data was overwritten. When the journal is intact and not wrapped, this gives the investigator a strong anchor for content modification. Other flags correspond to metadata or lifecycle events, so the reason code must be read literally.

Answer

The record only shows that the file was opened for read access, because DATA_OVERWRITE is logged when the data stream is read.

Answer

The record indicates only that the file's MFT metadata was updated, not that the file data stream changed.

Answer

The record confirms the file was deleted and then re-created with the same name at the recorded time.

Question 7

A GCFA analyst is reviewing a Windows 10 system and finds that the Security event log contains Event ID 4688 (process creation) entries, but the command line field is empty. The analyst needs to determine the full command line used by a suspicious process. Which configuration change, when enabled, would have populated the command line field in future Event ID 4688 entries?

Accepted Answer

Enable the 'Include command line in process creation events' policy under Administrative Templates > System > Audit Process Creation.. The 'Include command line in process creation events' policy is the specific setting that controls whether the command line is recorded in Event ID 4688. Enabling it ensures that future process creation events contain the full command line, which is essential for identifying malicious commands. Other audit policies enable the event but do not add command line data.

Answer

Enable the 'Turn on PowerShell Script Block Logging' policy under Administrative Templates > Windows Components > Windows PowerShell.

Answer

Enable the 'Process Creation' audit policy under Local Policies > Audit Policy.

Answer

Enable the 'Audit Process Creation' policy under Advanced Audit Policy Configuration > Detailed Tracking.

Question 8

A forensic analyst is reviewing a compromised Windows 10 host and finds a file named 'lsass.exe' in the C:\Windows\Temp directory. The file has a creation timestamp that coincides with the suspected intrusion time. The analyst wants to determine if this file is a malicious copy of the legitimate Windows process. Which characteristic of the legitimate lsass.exe should the analyst verify first to confirm the file is suspicious?

Accepted Answer

The file's digital signature and its original location in C:\Windows\System32. Legitimate Windows system executables like lsass.exe are stored in C:\Windows\System32 and are digitally signed by Microsoft. A copy found in C:\Windows\Temp is almost certainly malicious or a decoy. Verifying the digital signature and original location is a quick, offline method to confirm the file is not the genuine system process. Other checks like hash lookups or ACL review are useful but less immediate and definitive for this specific masquerading scenario.

Answer

The file's hash against a threat intelligence database like VirusTotal

Answer

The file's access control list (ACL) to see if permissions were modified

Answer

The file's size and version information compared to the known-good lsass.exe

Question 9

A security analyst is investigating a potentially compromised Windows 7 workstation. The analyst has acquired a memory image and wants to quickly identify any processes that have been terminated but might still have residual information in memory. Which Volatility 3 plugin should the analyst use to list processes that are no longer active but may still be present in the memory dump?

Accepted Answer

windows.psscan. The windows.psscan plugin scans physical memory for process objects, which allows it to find processes that have been terminated but whose structures have not been overwritten. This is useful for identifying residual evidence from terminated processes. In contrast, pslist and pstree only show active processes, and cmdline provides arguments for active processes. Therefore, psscan is the correct choice for finding terminated processes in a memory dump.

Answer

windows.cmdline

Answer

windows.pslist

Answer

windows.pstree

Question 10

During an investigation, you recover a deleted file from an NTFS volume. The MFT entry for the file shows that the $DATA attribute is non-resident, and the data runs are still intact. However, the $BITMAP attribute of the MFT indicates that the MFT entry is marked as unallocated. What is the most accurate conclusion about the recoverability of the file's content?

Accepted Answer

The file content is likely recoverable, but you must check the $Bitmap metadata file to confirm the clusters are not reallocated.. When an MFT entry is unallocated, the file's data runs may still be present, but the clusters they point to could have been reallocated. The $Bitmap metadata file tracks which clusters are in use. To determine recoverability, the analyst must check whether the clusters are marked as free in $Bitmap. If free, the content can likely be recovered; if allocated, the content may be overwritten.

Answer

The file content is unrecoverable because the MFT entry is unallocated, which means the data runs are invalid.

Answer

The file content can be fully recovered because the data runs are intact and point to clusters that have not been overwritten.

Answer

The file content can be recovered only if the $LogFile contains a record of the file's deletion.

Question 11

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Accepted Answer

This is a network logon using NTLM that warrants correlation with source host and account baseline.. Logon Type 3 identifies a network logon, and the NTLM authentication package means the session did not use Kerberos. That alone is not proof of compromise, but it is a meaningful indicator that must be baselined against the account's normal source hosts, logon patterns, and downstream privilege events before any conclusion about credential theft or lateral movement is drawn.

Answer

This is normal service account behavior and no further review is needed.

Answer

This proves credential theft via Pass-the-Hash against the service account.

Answer

This indicates a successful interactive console logon by an attacker.

Question 12

When investigating a suspected fileless malware infection, you identify an anomaly in the 'PowerShell' Operational log. Which event ID indicates the execution of a base64 encoded command string often used to obfuscate malicious scripts?

Accepted Answer

Event ID 4104. Event ID 4104 records the execution of a script block. Attackers frequently use PowerShell's -EncodedCommand parameter to bypass simple string-based signature detection. By analyzing the content of these logs, specifically looking for long, base64-encoded strings, analysts can decode the hidden payloads and reconstruct the attacker's actions, which is vital for understanding the full scope of a fileless attack that avoids traditional disk-based indicators.

Answer

Event ID 4100

Answer

Event ID 4103

Answer

Event ID 400

Question 13

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Accepted Answer

Decode the base64 string and perform script analysis. The command line uses the '-enc' parameter, indicating a base64-encoded PowerShell script. Forensic analysts must decode this string to understand the attacker's intent. Once decoded, the analyst can identify the actual commands being run—such as downloading additional payloads or communicating with C2 servers. This is critical in modern incident response because obfuscation is a routine tactic to evade basic keyword-based monitoring and initial detection by security analysts.

Answer

Search for the process name in the Shimcache

Answer

Check the MFT for the parent process file

Answer

Run a system file integrity check

Question 14

An attacker is using a living-off-the-land (LotL) technique to execute commands on a Linux server. Which log source is most likely to reveal the command-line arguments used?

Accepted Answer

Linux Audit Framework (auditd).. Linux auditd is the most robust tool for capturing process execution details. By configuring auditd to watch the 'execve' system call, responders can log every command executed, including its arguments, by every user on the system. This is invaluable during an incident because LotL techniques often use standard, trusted binaries to perform malicious acts, and command-line arguments are the only evidence distinguishing legitimate administrative use from an attacker's malicious actions.

Answer

Syslog (/var/log/syslog).

Answer

Apache Access Logs.

Answer

X11 Display Logs.

Question 15

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Accepted Answer

Take snapshots of all attached volumes for forensic imaging.. Evidence preservation in cloud environments requires non-destructive methods that maintain chain of custody while ensuring data integrity. By creating snapshots, isolating the affected instance, and extracting memory, responders ensure that the state of the system is preserved for deep forensic analysis. These steps are crucial because cloud instances are ephemeral and can be easily deleted or modified, which would destroy the evidence necessary to build a complete incident timeline and identify the root cause.

Answer

Shut down the instance immediately to stop the attack.

Answer

Delete all ephemeral logs to save on cloud storage costs.

Question 16

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Accepted Answer

Event ID 4624 with Logon Type 10.. The Windows Security Event log captures specific Logon Types that categorize the nature of the authentication. Logon Type 2 denotes an interactive local login, while Type 10 identifies Remote Interactive (RDP) sessions. Scheduled tasks typically utilize Type 4 (Batch) or Type 5 (Service), allowing analysts to differentiate between user-driven activity and automated system processes through forensic inspection of the event data.

Answer

Event ID 4672 during the authentication process.

Answer

Event ID 4648 involving the use of explicit credentials.

Answer

Event ID 4720 occurring at the same time.

Question 17

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Accepted Answer

The usage of 'IEX' to execute code in memory.. The command performs an 'In-Process' download and execution of a remote PowerShell script. By using 'IEX' (Invoke-Expression) combined with a web client download, the attacker executes the script directly in memory, bypassing the need to write a file to disk. This is a highly effective evasion technique that leaves minimal forensic footprint and is a standard delivery method for sophisticated, memory-resident malware payloads.

Answer

The usage of the 'echo' command.

Answer

The creation of a text file in C:\Users\Public.

Answer

The command uses the 'hidden' window flag.

Question 18

When reviewing Windows Event Logs, which event ID indicates that a user has successfully performed an interactive login, and why is this critical for identifying unauthorized lateral movement?

Accepted Answer

Event ID 4624, because it captures the logon type and source workstation.. Event ID 4624 is the primary indicator of a successful logon. Analyzing Logon Type 2 (interactive) or Logon Type 10 (Remote Desktop) allows analysts to track user access patterns. Monitoring these events helps distinguish between routine administrative access and abnormal logins occurring at odd hours or from unusual source IPs, which are standard red flags for compromised credentials being used by threat actors to traverse the network.

Answer

Event ID 4688, because it tracks the exact time of user authentication.

Answer

Event ID 4720, because it logs user account creation activity.

Answer

Event ID 4625, because it confirms the user has successfully bypassed MFA.

Question 19

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Accepted Answer

It is unreliable due to frequent updates by system services. The 'Last Accessed' timestamp is notoriously unreliable in forensic analysis because it is frequently updated by non-human system activity, such as antivirus scans or indexing services. Furthermore, many systems have the 'noatime' option enabled, which stops the OS from updating this field entirely. Because of this noise and potential for total absence, relying on this value for evidence of user activity is inherently dangerous and prone to producing false positives.

Answer

It is only updated if the file is moved to a different folder

Answer

It is the most easily forged timestamp in the MFT

Answer

It only exists on FAT32 file systems

Question 20

Which THREE items are typically stored in a thread's TEB (Thread Environment Block)?

Accepted Answer

Thread Local Storage (TLS) pointers. The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

Answer

Active process list pointer

Answer

Kernel-mode privilege level